mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-22 12:43:23 +00:00
55 lines
4 KiB
Markdown
55 lines
4 KiB
Markdown
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|
|
|
|
|
|
# Basiese Inligting
|
|
|
|
Kibana is bekend vir sy vermoë om data binne Elasticsearch te soek en te visualiseer, wat tipies op poort **5601** loop. Dit dien as die koppelvlak vir die Elastic Stack-kluster se monitering, bestuur en sekuriteitsfunksies.
|
|
|
|
## Verstaan van Verifikasie
|
|
|
|
Die proses van verifikasie in Kibana is inherent gekoppel aan die **akkrediteer wat in Elasticsearch gebruik word**. As Elasticsearch se verifikasie gedeaktiveer is, kan Kibana sonder enige akkrediteer toegang verkry. Omgekeerd, as Elasticsearch met akkrediteer beveilig is, is dieselfde akkrediteer nodig om toegang tot Kibana te verkry, wat identiese gebruikersregte oor albei platforms handhaaf. Akkrediteer kan in die **/etc/kibana/kibana.yml** lêer gevind word. As hierdie akkrediteer nie betrekking het op die **kibana_system** gebruiker nie, kan dit breër toegangregte bied, aangesien die toegang van die kibana_system gebruiker beperk is tot monitering API's en die .kibana-indeks.
|
|
|
|
## Aksies By Toegang
|
|
|
|
Sodra toegang tot Kibana beveilig is, is verskeie aksies raadsaam:
|
|
|
|
- Om data van Elasticsearch te verken, moet 'n prioriteit wees.
|
|
- Die vermoë om gebruikers te bestuur, insluitend die redigering, verwydering of skepping van nuwe gebruikers, rolle of API-sleutels, is onder Stack Management -> Users/Roles/API Keys te vind.
|
|
- Dit is belangrik om die geïnstalleerde weergawe van Kibana te kontroleer vir bekende kwesbaarhede, soos die RCE kwesbaarheid wat in weergawes voor 6.6.0 geïdentifiseer is ([Meer Inligting](https://insinuator.net/2021/01/pentesting-the-elk-stack/#ref2)).
|
|
|
|
## SSL/TLS Oorwegings
|
|
|
|
In gevalle waar SSL/TLS nie geaktiveer is nie, moet die potensiaal vir die lek van sensitiewe inligting deeglik geëvalueer word.
|
|
|
|
## Verwysings
|
|
|
|
* [https://insinuator.net/2021/01/pentesting-the-elk-stack/](https://insinuator.net/2021/01/pentesting-the-elk-stack/)
|
|
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|